Study: Single Connected Car Can Trick Smart Traffic Lights Into Causing Intersection Clogging

Researchers from the University of Michigan have shown that connected vehicle-based transportation systems can be interfered with using a single attack vehicle. Their research demonstrates how identifying a data spoofing strategy on one connected car can trick a traffic system into believing that an intersection is congested through vehicle-to-infrastructure (V2I) communication.

V2I is a form of wireless communication that allows vehicles to share information with traffic infrastructure components, such as automated toll collection systems, traffic cameras, traffic signals, and speed sensors.

READ: Securing the Transportation Network of Tomorrow

In the case of the research, the traffic signal control algorithm was affected, causing a traffic jam where what would have been a half-minute trip could take over seven minutes — 14 times longer — in 22 percent of the vehicles the researchers evaluated.

The researchers note that data spoofing attacks are “highly effective” for the signal control algorithm with the default configurations in the Intelligent Traffic Signal (I-SIG) system, a V21 system that has been implemented by the U.S. Department of Transportation in Anthem, Arizona, and Palo Alto, California, among other locations. The I-SIG system reduces the total delay by 27 percent, but its benefit can be effectively nullified by spoofed trajectory data from a single attack vehicle, which can increase the total delay by 68 percent and even make mobility 23 percent worse than if the I-SIG system were not used at all.

Securing connected cars against spoofing and other intrusions

The research also notes that despite the ITS implementations across cities today, traffic systems aren’t adequately secured from data spoofing and other potential intrusions. Traffic lights operating on open and unencrypted protocols, for instance, can be hacked to be always green. In addition, smart traffic lights can be hacked to subject smart cars that communicate with them to remote access vulnerabilities, false over-the-air updates, wrong traffic information, or even ransomware.

Smart traffic infrastructures should also be able to ensure the continuity of their basic services, as with other types of smart infrastructures. This would entail having a manual override ready despite the availability of fully automated systems. In case of a system malfunction or compromise, the manual override would enable operators to perform incident response even in the absence of internet connection or remote access.

READ: Security Considerations for Smart City Sectors

For car manufacturers, not only should car functionalities be prioritized, but IT security should also be focused on, starting in the design phase. Building penetration testing teams for risk assessments will allow manufacturers to look into vulnerabilities and appropriate mitigation measures, and will be a step in the right direction toward securing connected cars. It is advised that highly complex systems such as ITS have a security-by-design approach, in the same manner that they require a strategic framework for planning and deployment. This approach will allow car manufacturers to balance functionality with security and prevent unforeseen problems.

Aside from our recommendations on employing network segmentation, firewalls, and antimalware as a mandatory minimum, solutions that are able to provide protection against potential intrusions and spoofed data on vehicle networks should be adopted by automobile manufacturers and owners alike.